CVSS 4.0
6.9 mediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:NCVE-2026-53493
Medium (6.9). EPSS 0.4% chance of exploitation in the next 30 days. Fixed in github.com/containerd/containerd/v2 2.0.13, 2.2.9, 2.3.6.
containerd is an open-source container runtime. Prior to versions 1.7.36, 2.0.13, 2.2.9, 2.3.6, and 2.4.1, a crafted OCI index graph can force very high CPU/memory usage during PullImage (before container start), causing long ContainerCreating stalls and, at larger sizes, node/runtime instability. Versions 1.7.36, 2.0.13, 2.2.9, 2.3.6, and 2.4.1 fix the issue.
Severity
- EPSS
- 0.4% chance of exploitation in the next 30 days; higher than 29% of CVEs (scores of 2026-11-01)
- CWEs
- CWE-400, CWE-770, CWE-834
- Published
- Modified
- Record from
- the NVD, synced
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-pg57-6jwg-q645 | Go | github.com/containerd/containerd/v2 | >=2.0.0 <2.0.13 | 2.0.13 |
| GHSA-pg57-6jwg-q645 | Go | github.com/containerd/containerd | <1.7.36 | 1.7.36 |
| GHSA-pg57-6jwg-q645 | Go | github.com/containerd/containerd/v2 | >=2.1.0 <2.2.9 | 2.2.9 |
| GHSA-pg57-6jwg-q645 | Go | github.com/containerd/containerd/v2 | >=2.3.0 <2.3.6 | 2.3.6 |
| GHSA-pg57-6jwg-q645 | Go | github.com/containerd/containerd/v2 | >=2.4.0 <2.4.1 | 2.4.1 |
| GO-2026-6597 | Go | github.com/containerd/containerd | <1.7.36 | 1.7.36 |
| GO-2026-6597 | Go | github.com/containerd/containerd/v2 | >=2.0.0 <2.0.13 >=2.1.0 <2.2.9 >=2.3.0 <2.3.6 >=2.4.0 <2.4.1 | 2.0.13, 2.2.9, 2.3.6, 2.4.1 |